---- On Sun, 15 Feb 2015 19:34:37 +0000 Paul "LeoNerd" Evans<leon...@leonerd.org.uk> wrote ---- > On Tue, 13 Jan 2015 00:29:43 +0200 > Denis Ovsienko <de...@ovsienko.info> wrote: > > > List, > > > > there is an idea to improve libpcap and tcpdump to enable the latter > > to print interface name (index) and direction of each packet: > > > > https://github.com/the-tcpdump-group/tcpdump/issues/296 > > https://github.com/the-tcpdump-group/libpcap/issues/127 > > > > It is pretty much clear how to do that: the only way would be through > > a new DLT, a proposal for which is made here: > > https://github.com/the-tcpdump-group/tcpdump-htdocs/pull/3 > > > > Let me ask for feedback on this change because the original author > > has issues posting to the mailing list. > > So, uhm... > > Any thoughts on this so far? I'm really keen to have it applied, > because I already have a full implementation of a tcpdump-like program > that I wrote almost entirely *because* libpcap+tcpdump can't do this. > It would be great to have it supported by core after all.
There are following differences of the proposed SLL2 from the existing SLL: 1. the Packet type field is 1 byte long (now as in struct sockaddr_ll) 2. same for the Link-layer address length field 3. there is a new Interface index field 4 bytes long (same as in sockaddr_ll) This makes SLL2 quite close to sockaddr_ll (except the the order of fields and the sll_family field, which is told to be equal to AF_PACKET in this case). In other words, it looks sufficiently good on paper to proceed with the implementation. -- Denis Ovsienko _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers